Add workflow for publishing llvm-firtool (#5)

* Add publishing logic for llvm-firtool
* Add workflow for publishing llvm-firtool

.github/workflows/publish-llvm-firtool.yml

@@ -0,0 +1,84 @@
+name: Publish LLVM Firtool
+
+on:
+  # workflow_dispatch and workflow_call arguments should be kept identical
+  # https://github.com/orgs/community/discussions/39357
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'The version of firtool and llvm-firtool to publish'
+        required: true
+        type: string
+      snapshot:
+        description: 'Should the version of llvm-resolver be a SNAPSHOT'
+        default: true
+        required: true
+        type: boolean
+  workflow_call:
+    inputs:
+      version:
+        description: 'The version of firtool and llvm-firtool to publish'
+        required: true
+        type: string
+      snapshot:
+        description: 'Should the version of llvm-resolver be a SNAPSHOT'
+        default: true
+        required: true
+        type: boolean
+
+jobs:
+  test:
+    name: Run Tests
+    uses: ./.github/workflows/test.yml
+    with:
+      version: ${{ inputs.version }}
+      snapshot: ${{ inputs.snapshot }}
+
+  publish:
+    name: Publish LLVM Firtool
+    runs-on: ubuntu-20.04
+   needs: test
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Install Scala and Coursier
+        uses: coursier/setup-action@v1
+        with:
+          jvm: adopt:11
+      - name: Check if already published
+        if: ! inputs.snapshot
+        # TODO skip if snapshot
+        run: |
+          if cs fetch org.chipsalliance:llvm-firtool:${{ inputs.version }} ; then
+            echo "llvm-firtool version ${{ inputs.version }} has already been published!" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          else
+            exit 0
+          fi
+      - name: Set versions
+        shell: bash
+        run: |
+          if [[ "${{ inputs.snapshot }}" = 'true' ]]; then
+            IS_PRERELEASE=1
+          else
+            IS_PRERELEASE=0
+          fi
+          echo "LLVM_FIRTOOL_PRERELEASE=$IS_PRERELEASE" >> "$GITHUB_ENV"
+          echo "LLVM_FIRTOOL_VERSION=${{ inputs.version }}" >> "$GITHUB_ENV"
+      - name: Import GPG key
+        # This is crazy-max/ghaction-import-gpg@v6, using commit for security reasons
+        uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef
+        with:
+          gpg_private_key: ${{ secrets.PGP_SECRET }}
+          passphrase: ${{ secrets.PGP_PASSPHRASE }}
+      - name: Publish
+        shell: bash
+        run: |
+          ./mill -i llvm-firtool.publishSigned
+        env:
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          SONATYPE_PASSWORD: ${{ secrets.CHIPSALLIANCE_SONATYPE_PASSWORD }}
+          SONATYPE_USERNAME: ${{ secrets.CHIPSALLIANCE_SONATYPE_USERNAME }}
+

build.sc

@@ -14,21 +14,42 @@ object Platform {
   implicit val rw: ReadWriter[Platform] = macroRW
 }
 
+trait ChipsAlliancePublishModule extends PublishModule {
+
+  def isSnapshot: Boolean
+
+  override def sonatypeUri: String = "https://s01.oss.sonatype.org/service/local"
+  override def sonatypeSnapshotUri: String = "https://s01.oss.sonatype.org/content/repositories/snapshots"
+  protected def getEnvVariable(name: String): String =
+    sys.env.get(name).getOrElse(s"Environment variable $name must be defined!")
+
+  def gpgArgs: Seq[String] = Seq(
+    "--detach-sign",
+    "--batch=true",
+    "--yes",
+    "--passphrase",
+    getEnvVariable("PGP_PASSPHRASE"),
+    "--armor",
+    "--use-agent"
+  )
+
+  // Helper for publishing, sets values so we don't have to set them on the command-line
+  def publishSigned() = T.command {
+    val release = !isSnapshot
+    publish(gpgArgs = gpgArgs, release = release)
+  }
+}
+
 // Must run mill with -i because it uses environment variables:
 // LLVM_FIRTOOL_VERSION - (eg. 1.58.0)
 // LLVM_FIRTOOL_PRERELEASE - 0 means real release (non-SNAPSHOT), otherwise is -SNAPSHOT
-// Release SNAPSHOT with:
-// mill mill.scalalib.PublishModule/publishAll llvm-firtool.publishArtifacts $SONATYPE_USERNAME:$SONATYPE_PASSWORD --sonatypeSnapshotUri https://s01.oss.sonatype.org/content/repositories/snapshots --signed false --release false
-// See docs: https://mill-build.com/mill/Scala_Build_Examples.html#_publish_module
-object `llvm-firtool` extends JavaModule with PublishModule {
-
-  private def getEnvVariable(name: String): String =
-    sys.env.get(name).getOrElse(s"Environment variable $name must be defined!")
+object `llvm-firtool` extends JavaModule with ChipsAlliancePublishModule {
 
   def firtoolVersion = getEnvVariable("LLVM_FIRTOOL_VERSION")
   // FNDDS requires that the publish version start with firtool version with optional -<suffix>
-  def publishSuffix = if (getEnvVariable("LLVM_FIRTOOL_PRERELEASE") == "0") "" else  "-SNAPSHOT"
-  require(publishSuffix.headOption.forall(_ == '-'), s"suffix must start with -, got '$publishSuffix'")
+  def isSnapshot = getEnvVariable("LLVM_FIRTOOL_PRERELEASE") != "0"
+
+  def publishSuffix = if (isSnapshot) "-SNAPSHOT" else ""
   def publishVersion = firtoolVersion + publishSuffix
 
   private def FNDDSSpecVersion = "1.0.0"
@@ -159,11 +180,13 @@ object `llvm-firtool` extends JavaModule with PublishModule {
   }
 }
 
-object `firtool-resolver` extends ScalaModule with PublishModule {
+object `firtool-resolver` extends ScalaModule with ChipsAlliancePublishModule {
   def scalaVersion = "2.13.11"
 
   def publishVersion = "1.0.0-SNAPSHOT"
 
+  def isSnapshot = true
+
   def pomSettings = PomSettings(
     description = "Fetcher for native firtool binary",
     organization = "org.chipsalliance",